Pulling Bits from ROM Silicon Die Images: Unknown Architecture | Hacker News Reader

Pulling Bits from ROM Silicon Die Images: Unknown Architecture

ryancor.medium.com

94 pointsmariuz16 comments

Will give this a more thorough read later, but definitely has a Chris Tarnovsky feel of what he had posted about paytv cards.

Whenever dealing with HF (hydrofluoric acid, not high frequency!) make sure you have your calcium-based antidotes handy and get yourself to a hospital if exposed. It’s incredibly harmful, but may not feel that way.

Indeed. HF causes life-long disfigurement and can be fatal. IV calcium gluconate is the antidote in question, often prescribed until ECG changes become limiting. It is a small ion and literally eats your bones. I'm amazed you can buy it in a product from Amazon in the US.

That warning aside, this article is amazing --- very insightful. I've no idea how to begin reversing an unknown architecture's firmware. I'm still not entirely sure I know the point of this, but it's definitely fun...

Industrially, I’ve seen calcium topical formulations as something to hold you over.

You can get calcium gluconate gel on amazon, its good to keep that on hand!

If you think there is anything I didn't stress enough in the article with the dangers of HF, please let me know i'll add. I mentioned calcium ion attraction, and eating bones, etc. I also mentioned that I have using whink which is 1.5% conc of HF and to not go to a higher conc

This is pretty mind blowing. I’m barely grasping the idea of being capable of manufacturing something _this_ small. But reversing the process is straight up there with unscrambling eggs. Just wow.

From an image processing perspective I think this is just like reading a 2-d barcode like data matrix or QR or maybe reading a punchcard.

Getting to the image though is an act of physical heroism that he builds up to gradually (e.g. how can you really be so afraid of H2SO4?) to the point where he is mixing acids with bleach at which point I'm intimidated.

Two things make extracting the data more complex than something like a QR code or punchcard. First, the image quality from a die usually isn't perfect. There are often a few spots where it's hard to figure out visually, let alone with software.

Second, the ROM layout isn't documented and there are a lot of possibilities. Big-endian or little-endian? Is a transistor a 1 or 0? What direction does the layout go? Are columns or rows more significant bits? So you end up with 2×2×2×... possibilities for interpretation. And that's assuming the ROM layout doesn't have something entirely unexpected, which happens quite often.

H2SO4 isn't that intimidating. Neither is HCl. HF is VERY intimidating, if you're smart. And you *REALLY* don't want to encounter the anhydrous gaseous form.

I would say SO2 fumes is not something you really want to be to relaxed with. But I agree with HCl, its nothing too scary compared. HF is scary as shit, even the low conc i use which is like 1.5%, im still in full PPE gear, even a respirator, it doesn't fume at room temp but still makes me that nervous.

It's a bit harder than that. 2D Barcodes, Data Matrices, QR Codes, all explicitly have a lot of redundancy built in for resilient error correction. A chip has none of that, it's designed to do its electrical work sitting in a package forever, not to be looked at by anything or anyone.

And then you have separate layers with vastly different physical (and photographic) properties, and the answers to any questions is often in how they interact...

I was first introduced to this concept through emulation, specifically Super Nintendo & Arcade work and would eagerly watch change logs. It is amazing to see it really step by step, and even now it still feels like magic.

- https://news.ycombinator.com/item?id=3675123

Before them, flylogic was publicly documenting the same kind of work in 2007.

https://web.archive.org/web/20080612172433/http://www.flylog...

Surprisingly references is missing http://caps0ff.blogspot.com <- guys recovering data from Arcade and old computer chips.

I work with him a lot, he's a friend, and he prefers to stay anonymous. :) why I didn't reference the site with the name

This reminds me of seeing a part of the chip from a scanning electron microscope: https://youtu.be/1kQUXpZpLXI?t=169

But I wonder how successful these methods are are extracting keys from a TPM or other hardware keys.

Reply on news.ycombinator.com